Yii use ".htaccess" file to protect the protected directory
deny from all
To make sure .htaccess file is working, browse "localhost/[Your Web App]/protected/data/schema.mysql.sql".
if “.htaccess” file is working, you will get “You don’t have permission to access /[Your Web App]/protected/data/schema.mysql.sql on this server.”
otherwise edit httpd.conf AllowOveride directive to "All", restart Apache server and test it again.